Hash functions - PVAC-HFHE

Overview

This module provides cryptographic hash functions (SHA-256) and extendable-output functions (SHAKE256) for key derivation, commitments, and deterministic randomness expansion in PVAC-HFHE.

SHA-256

Sha256

SHA-256 hash state for incremental hashing.

struct Sha256 {
    uint32_t h[8];
    uint64_t len;
    uint8_t buf[64];
    size_t ptr;
};

uint32_t[8]

Hash state (eight 32-bit words)

len

uint64_t

Total number of bytes processed

buf

uint8_t[64]

Input buffer for the current block

ptr

size_t

Current position in buffer

Methods

init

Initializes the hash state.

void init();

Example:

Sha256 hasher;
hasher.init();

update

Processes data incrementally.

void update(const void* data, size_t n);

data

const void*

Pointer to data to hash

size_t

Number of bytes to process

Example:

Sha256 hasher;
hasher.init();
hasher.update("hello", 5);
hasher.update("world", 5);

finish

Finalizes the hash and produces the digest.

void finish(uint8_t out[32]);

out

uint8_t[32]

Output buffer for 256-bit (32-byte) digest

Example:

Sha256 hasher;
hasher.init();
hasher.update(data, len);

uint8_t digest[32];
hasher.finish(digest);

Convenience functions

sha256_bytes

Computes SHA-256 hash of a single buffer.

void sha256_bytes(const void* data, size_t n, uint8_t out[32]);

data

const void*

Input data

size_t

Input length in bytes

out

uint8_t[32]

Output digest

Example:

uint8_t digest[32];
sha256_bytes("hello world", 11, digest);

sha256_acc_u64

Accumulates a 64-bit integer into the hash in little-endian format.

void sha256_acc_u64(Sha256& s, uint64_t x);

Sha256&

Hash state

uint64_t

Value to hash

Example:

Sha256 s;
s.init();
sha256_acc_u64(s, 0x123456789ABCDEFULL);
sha256_acc_u64(s, timestamp);

uint8_t digest[32];
s.finish(digest);

SHAKE256

Shake256

SHAKE256 XOF (extendable-output function) state.

struct Shake256 {
    uint64_t st[25];
    size_t rate;
    size_t pos;
    bool squeezing;
};

uint64_t[25]

Keccak state (1600 bits)

rate

size_t

Rate parameter (136 bytes for SHAKE256)

pos

size_t

Current position in rate bytes

squeezing

bool

True if in squeezing mode, false if absorbing

Methods

init

Initializes SHAKE256 state.

void init();

Example:

Shake256 xof;
xof.init();

absorb

Absorbs input data into the sponge.

void absorb(const uint8_t* data, size_t len);

data

const uint8_t*

Input data

len

size_t

Input length in bytes

Example:

Shake256 xof;
xof.init();
xof.absorb((const uint8_t*)"seed", 4);
xof.absorb((const uint8_t*)&counter, sizeof(counter));

Do not call absorb() after calling squeeze(). The function will abort if called in squeezing mode.

pad

Finalizes absorption and switches to squeezing mode.

void pad();

Example:

xof.absorb(seed, seed_len);
xof.pad();
// Now ready to squeeze output

squeeze

Extracts output bytes from the XOF.

void squeeze(uint8_t* out, size_t len);

out

uint8_t*

Output buffer

len

size_t

Number of bytes to extract

Example:

uint8_t output[1024];
xof.squeeze(output, 1024);

You can call squeeze() multiple times to extract as much output as needed. The function automatically calls pad() if not already in squeezing mode.

next_u64

Extracts the next 64-bit integer from the XOF.

uint64_t next_u64();

return

uint64_t

Next 64 bits of output

Example:

uint64_t r1 = xof.next_u64();
uint64_t r2 = xof.next_u64();

XofShake

High-level wrapper for SHAKE256 with domain-separated seeding.

struct XofShake {
    Shake256 sh;
};

Methods

init

Initializes XOF with a label and seed.

void init(const std::string& label, const std::vector<uint64_t>& seed);

label

const std::string&

Domain separation label (e.g., from Dom namespace)

seed

const std::vector<uint64_t>&

Seed values in little-endian format

Example:

XofShake xof;
std::vector<uint64_t> seed = {tag, nonce.lo, nonce.hi};
xof.init(Dom::NOISE, seed);

take_u64

Extracts the next 64-bit value.

uint64_t take_u64();

return

uint64_t

Next 64-bit value

Example:

uint64_t random = xof.take_u64();

bounded

Generates a uniformly random integer in the range [0, M).

uint64_t bounded(uint64_t M);

uint64_t

Upper bound (exclusive)

return

uint64_t

Uniformly random value in [0, M)

Example:

// Random value in [0, 100)
uint64_t dice = xof.bounded(100);

// Random index for array of size n
size_t idx = xof.bounded(n);

This function uses rejection sampling to ensure uniform distribution, avoiding modulo bias.

Utility functions

hex8

Converts binary data to hexadecimal string.

std::string hex8(const uint8_t* d, size_t n);

const uint8_t*

Input data

size_t

Number of bytes

return

std::string

Hexadecimal string (lowercase)

Example:

uint8_t digest[32];
sha256_bytes(data, len, digest);
std::string hex = hex8(digest, 32);
std::cout << "Hash: " << hex << std::endl;

Usage patterns

Computing public key digest

Sha256 s;
s.init();
for (const auto& h_row : pk.H) {
    s.update(h_row.w.data(), h_row.w.size() * sizeof(uint64_t));
}
s.finish(pk.H_digest.data());

Deterministic random stream

XofShake xof;
std::vector<uint64_t> seed = {prf_key[0], prf_key[1], prf_key[2], prf_key[3]};
xof.init(Dom::PRF_LPN, seed);

// Generate random matrix
for (int i = 0; i < rows; i++) {
    for (int j = 0; j < cols; j++) {
        matrix[i][j] = xof.take_u64();
    }
}

Sampling without replacement

XofShake xof;
xof.init(Dom::X_SEED, seed);

std::set<size_t> selected;
while (selected.size() < target_count) {
    size_t idx = xof.bounded(total_count);
    selected.insert(idx);
}

Commitment scheme

// Commit
uint8_t commitment[32];
Sha256 s;
s.init();
s.update(message, message_len);
sha256_acc_u64(s, randomness);
s.finish(commitment);

// Verify
uint8_t recomputed[32];
s.init();
s.update(revealed_message, message_len);
sha256_acc_u64(s, revealed_randomness);
s.finish(recomputed);

bool valid = std::memcmp(commitment, recomputed, 32) == 0;

Security properties

SHA-256

Collision resistance: ~128-bit security
Preimage resistance: 256-bit security
Second preimage resistance: 256-bit security

SHAKE256

Security level: 256-bit (for 512-bit output)
Collision resistance: 128-bit
Uniformity: Output is computationally indistinguishable from random

Performance

SHA-256: ~300-500 MB/s on modern CPUs
SHAKE256: ~150-250 MB/s on modern CPUs
Hardware acceleration (AES-NI, SHA extensions) not currently used

Types - Domain separation constants
Random generation - Cryptographically secure random bytes
Field operations - Used with deterministic randomness

Core

Cryptography

Operations

Utilities

Documentation Index

​Overview

​SHA-256

​Sha256

​Methods

​init

​update

​finish

​Convenience functions

​sha256_bytes

​sha256_acc_u64

​SHAKE256

​Shake256

​Methods

​init

​absorb

​pad

​squeeze

​next_u64

​XofShake

​XofShake

​Methods

​init

​take_u64

​bounded

​Utility functions

​hex8

​Usage patterns

​Computing public key digest

​Deterministic random stream

​Sampling without replacement

​Commitment scheme

​Security properties

​SHA-256

​SHAKE256

​Performance

​Related

Build docs developers (and LLMs) love

Overview

SHA-256

Sha256

Methods

init

update

finish

Convenience functions

sha256_bytes

sha256_acc_u64

SHAKE256

Shake256

Methods

init

absorb

pad

squeeze

next_u64

XofShake

XofShake

Methods

init

take_u64

bounded

Utility functions

hex8

Usage patterns

Computing public key digest

Deterministic random stream

Sampling without replacement

Commitment scheme

Security properties

SHA-256

SHAKE256

Performance

Related